PT-2017-2003 · Cisco · Cisco Ios Xe+1

Published 2017-04-19 · Updated 2017-07-11 · CVE-2017-3860

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.2 and 15.0 through 15.6 Cisco IOS XE versions 3.2 through 3.18

Description The issue is caused by improper parsing of crafted EnergyWise packets destined to an affected device, which could allow an unauthenticated, remote attacker to cause a buffer overflow condition or a reload of an affected device, leading to a denial of service (DoS) condition. The vulnerabilities can be triggered by sending crafted EnergyWise packets to be processed by an affected device. Only IPv4 packets destined to a device configured as an EnergyWise domain member can trigger these vulnerabilities, as IPv6 packets cannot be used to exploit them.

Recommendations For Cisco IOS versions 12.2 and 15.0 through 15.6, update to a fixed version of Cisco IOS Software. For Cisco IOS XE versions 3.2 through 3.18, update to a fixed version of Cisco IOS XE Software. As a temporary workaround, consider restricting access to the EnergyWise module to minimize the risk of exploitation.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2017-01169

CVE-2017-3860

Affected Products

Cisco Ios

Cisco Ios Xe

References · 6

• https://bdu.fstec.ru/vul/2017-01169 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-3860 · Security Note
• https://osv.dev/vulnerability/CVE-2017-3860 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170419-energywise · Vendor Advisory
• http://securityfocus.com/bid/97935 · Note
• http://securitytracker.com/id/1038313 · Note